Установка
sudo -s apt-get update && apt install fail2ban
Создаём фильтр
nano /etc/fail2ban/filter.d/nextcloud.conf
В файле пишем следующее:
[Definition]
failregex={"reqId":".*","remoteAddr":".*","app":"core","message":"Login failed: '.*' \(Remote IP: '<HOST>'\)","level":2,"time":".*"}
ignoreregex =
Редактируем файл настроек сервисов
nano /etc/fail2ban/jail.conf
nano /etc/fail2ban/jail.conf
В конце добавляем
[nextcloud]
enabled = true
port = 443
protocol = tcp
filter = nextcloud
maxretry = 3
bantime = 180
logpath = /var/users_nextcloud/owncloud.log
Рестарт сервиса
service fail2ban restart
Собственно проверка и смотрим
fail2ban-client status nextcloud
Если нужно срочно разбанить
fail2ban-client set nextcloud unbanip <Banned IP>
У меня не взлетело, в логах:
ОтветитьУдалить2017-06-06 21:28:42,262 fail2ban.actions [16248]: ERROR Failed to start jail 'sshd' action 'iptables-multiport': Error starting action
2017-06-06 21:28:54,092 fail2ban.transmitter [16248]: WARNING Command ['status', 'nextcloud'] has failed. Received UnknownJailException('nextcloud',)
и после команды fail2ban-client status nextcloud
ERROR NOK: ('nextcloud',)
Sorry but the jail 'nextcloud' does not exist
Нашел ошибку:
ОтветитьУдалитьв nextcloud.conf нужно было добавить
[INCLUDES]
before = common.conf
cat /etc/fail2ban/filter.d/nextcloud.conf
ОтветитьУдалить[INCLUDES]
before = common.conf
[Definition]
failregex = {"reqId":".*","level":2,"time":".*","remoteAddr":".*","user":".*","app":"core","method":"POST","url":".*","message":"Login failed: '.*' \(Remote IP: ''\)","userAgent":".*","version":".*"}
ignoreregex =